How can I detect a keylogger on my system?

Question

How could I know if there's a keylogger in my system, or at least if one is active right now?

Answer 1

Is a keylogger running right now?

• First, we'll assume you're using a stock Ubuntu system that X installed and that has always been under X's control -- where X is yourself or someone you absolutely trust.

• Since this is a stock system and all software has been installed from the official repositories, you can be certain that there is no hidden keylogger in there, e.g. someone modifies the kernel specially to spy on you such that it is very hard to detect.

• Then, if a keylogger is running, it's process(es) will be visible. All you need to do is use ps -aux, or htop to look at the list of all running processes and figure out if anything is suspicious.

  • The most common "legitimate" Linux keyloggers are lkl, uberkey, THC-vlogger, PyKeylogger, logkeys. logkeys is the only one available in the Ubuntu repositories.

Did I accidentally download a trojan/virus keylogger?

• Usually this risk is very minimal on Ubuntu/Linux because of the privileges (su) required.
• You can try using a "rootkit" detector as Mitch noted in his answer.
• Otherwise, it comes down to forensic analysis, such as tracing/debugging processes, looking at file modifications/timestamps between boots, sniffing network activity, etc.

What if I'm on an "untrusted" Ubuntu system?

So what if you're in an internet/cybercafe, at the library, at work, etc.? Or even a home computer used by many family members?

Well, all bets are off in that case. It's fairly easy to spy on your keystrokes if someone has enough skill/money/determination:

• There are hardware USB or PS/2 keyloggers that sit between the keyboard and the computer, logging each keystroke into built-in memory; they can be hidden inside the keyboard, or even inside the computer case.
• Cameras can be positioned so that your keystrokes are visible or can be figured out.
• If all else fails, a police state can always send their goons after you to force you to tell them what you were typing at gunpoint :/

So, the best you can do with an untrusted system is to take your own Live-CD/Live-USB and use that.

Answer 2

Yes, Ubuntu can have a key-logger. Its far fetched, but it can happen. It can be exploited via a browser and an attacker can run code with your user privileges. It can use auto-start services which run programs on login. Any program can get scan codes of pressed keys in X Window System. It is easily demonstrated with xinput command. See GUI isolation for more details.¹

linux key loggers needs to have a root access before they can monitor the keyboard. unless they don't gain that privilege they can't run a key logger. The only thing that you can do is check for rootkits. To do that you can use CHKROOTKIT

^{1Source:superuser.com}